fix(patch): fix #886, #885, patchOnProperties getter should return original listener.

[JiaLiPassion]

fix #886.
fix #885.
fix angular/angular-cli#7502.
patchOnProperties getter should return original listener.

the issue can be described as following code.

  const req = new XMLHttpRequest();
         req.open('get', '/', true);
         const listener = req.onreadystatechange = function() {
           if (req.readyState === 4) {
             done();
           }
         };
         expect(req.onreadystatechange).toBe(listener);
         req.onreadystatechange = function() {
           return listener.apply(this, arguments);
         };
         req.send();

when try to get onProperty listener with such as const listener = req.onreadystatechange, should not return wrapFn but the real listener.

[andrew-donovan]

Any ETA on this ? We currently have to force 0.8.16 in our project (17 is breaking)

[matt-filion]

I'm not a regular contributor here but these changes seem fairly safe and are paired with a valid test case.